summaryrefslogtreecommitdiffstats
path: root/Tools/msi/bundle/bootstrap/pythonba.cpp
diff options
context:
space:
mode:
authorstratakis <cstratak@redhat.com>2023-06-05 15:42:56 (GMT)
committerGitHub <noreply@github.com>2023-06-05 15:42:56 (GMT)
commit9c2ff15b9aa9f20c2340ad69cbf2300528db9a44 (patch)
tree06f1dcde5157048546c00939f23f7cbc920c9548 /Tools/msi/bundle/bootstrap/pythonba.cpp
parentc43c50e07ec35e4f66b6893fd940b8e098a12eb2 (diff)
downloadcpython-9c2ff15b9aa9f20c2340ad69cbf2300528db9a44.zip
cpython-9c2ff15b9aa9f20c2340ad69cbf2300528db9a44.tar.gz
cpython-9c2ff15b9aa9f20c2340ad69cbf2300528db9a44.tar.bz2
[3.8] gh-102153: Start stripping C0 control and space chars in `urlsplit` (GH-102508) (GH-104575) (GH-104592) (#104593) (#104895)
`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit GH-25595. This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329). I simplified the docs by eliding the state of the world explanatory paragraph in this security release only backport. (people will see that in the mainline /3/ docs) (cherry picked from commit d7f8a5fe07b0ff3a419ccec434cc405b21a5a304) (cherry picked from commit 2f630e1ce18ad2e07428296532a68b11dc66ad10) (cherry picked from commit 610cc0ab1b760b2abaac92bd256b96191c46b941) (cherry picked from commit f48a96a28012d28ae37a2f4587a780a5eb779946) Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Co-authored-by: Illia Volochii <illia.volochii@gmail.com> Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
Diffstat (limited to 'Tools/msi/bundle/bootstrap/pythonba.cpp')
0 files changed, 0 insertions, 0 deletions